Transport & certificates
HTTPS behavior and the TLS observations available from the target connection.
Quick scanEvidence-led website security
See what your app reveals before launch.
Review a live website's visible security posture with concrete evidence. Start with a bounded public-surface scan; verify control before deeper checks.
Bounded checksEvidence with findingsNo signup wall
Illustrative example · not a live scan
your-app.exampleQuick scan · ownership not verified
SampleChecks that ranPublic surface
ResultEvidence first
ObservationIllustrative only
Security headers reviewedThe report shows observed evidence and clearly marks checks that were not run.
evidence is redacted before display Findings reflect checks that actually ran
Clear scope, from the first request
Guest scans observe the public surface. Deeper checks require a short-lived proof that you control the hostname. Login-protected authorization checks need explicitly configured test accounts and permission context.
What the scanner can observe
Useful evidence, with limits made visible.
The quick scan uses the existing public-surface checks. It does not probe sensitive file paths or test private APIs before ownership is verified.
HTTP security headers
Headers and browser-visible page configuration from the normal page load.
Quick scanPage content & forms
Evidence visible in the loaded page, such as mixed content or insecure form actions.
Quick scanExposed configuration
Bounded checks for sensitive paths, backups, source maps and public API documentation.
After hostname verificationA straightforward workflow
Start small. Go deeper with permission.
Enter a website
Submit an HTTP or HTTPS URL. The server validates the target before any scan begins.
Review the quick scan
See findings, redacted evidence, checks completed and checks not tested before any signup prompt.
Verify for deeper checks
Prove control with a DNS TXT record or a token at a well-known path. The proof expires and applies to that hostname.
Evidence over empty scores
Know what a finding is based on.
VibeMetricsAI presents scanner findings with supporting evidence and remediation guidance when available. A confirmed issue is distinguished from an incomplete or inconclusive observation.
No findings means only that the checks that ran did not detect an issue. It is not a guarantee that an application is secure.
Optional account
Keep a history for later comparisons.
Read the full guest report first. If you want it in your history, choose Save Results at the bottom and then log in or sign up.
Frequently asked
Understand the scan before you start.
Can I scan without an account?
Yes, when guest scanning is enabled by the server. The quick scan is bounded to public-surface observations and its result is available in the same browser for a limited time.
What runs in a guest quick scan?
The quick profile loads the declared public page through the SSRF-safe scanner, observes supported transport details and runs the existing browser-visible security checks. Sensitive-file, source-map and backend exposure probes are not run in this mode.
Why verify ownership for deeper checks?
Some checks request additional paths or inspect discovered backend resources. A DNS TXT record or a token served from the hostname demonstrates control before those bounded probes run.
Does the scanner test login-protected pages?
No. Login-protected authorization and data-isolation checks require explicitly configured test accounts and an authorization context. They are not enabled by a public quick scan or hostname proof.
Does no finding mean the site is secure?
No. A result describes only the checks that ran, for the supplied target and at that time. Unrun, unsupported and inconclusive checks remain limitations.
How long are guest results kept?
The guest capability expires 20 minutes after it is created. Guest jobs stay in temporary server memory and are removed after expiry; they are not added to an account's history. Create an account to use authenticated history and later comparisons.
How do I save a guest result?
Read the report first, then choose Save Results at its bottom. Login or sign up is requested only for that save; the same scan is added to your private history.
What should I do after finding an exposed secret?
Revoke and rotate the credential with its provider, review its access logs, remove it from public assets and invalidate exposed copies where possible.